1943fd4317d3268e20305ec6fcb4a44aa84a7fcfdc35b18fd1448d9c76b0f6a3

Analysis

max time kernel
116s
max time network
143s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

64KB
MD5

de2543912e733d80edcb4288476a819f
SHA1

7a047b8832ea12f7e6961c8a8b5a1f3d47cf217e
SHA256

87f0b15ef62d1ddb4f0bc31b7546341bf634c29e4da485f140187814ddc62256
SHA512

4d12bcce29a0946dd95a165bde530481d0e54edb5ffb585bd843244652d3522a701d5e999677a61d86656ed5f2c24094cf6318ee4891159a591ef80788d57a73
SSDEEP

1536:s/q2atw9WHu9+1YUNxMHHXgX8wSwCwIFykukIsKwq:s/q2aq82Ht4nkq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388654777"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBC9BE71-DE84-11ED-9547-52C255710AF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
904	iexplore.exe
904	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 576	904	iexplore.exe	28
PID 904 wrote to memory of 576	904	iexplore.exe	28
PID 904 wrote to memory of 576	904	iexplore.exe	28
PID 904 wrote to memory of 576	904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
81c4141dbe659df485a0a032a779ae21

SHA1
a633b71163e3109f15a6659b35997f9b74f2632e

SHA256
97c26488097dc428aa2b572d60fdc1c5262919a1884ea4e770735a4ce086a12f

SHA512
59ba7ba52b31b402617f0be4c988cd6eae4abf74747600d63cba0efb2f6625890741983e5f29aa7b3f8b3e92bead1b110eba9192d18735141735e919df756150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_91DF16218BAC821A4575D2F721820BAA

Filesize
472B

MD5
ec4c5d365332676d8c4cf195ae930bb3

SHA1
6f069cb368eb9a7d4ac196c46215cf828224102b

SHA256
d66826a356046f5aab053d6b480d11f7b287aac6eeca743e46ac980ba6c24d63

SHA512
3c47ef958f7494ed0a4430504cffa4c0163baa64d62bb2bff159f9dd4ec7fa5966115daa05fa3822d29c1572ea9ad96f2fe336e7c32d338fab45add18b759da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
030093b98dd709afc3cdd0e5a3796739

SHA1
bd2fd7e60a2f7ebc76e48f83bc67082f2365500a

SHA256
75f3dd7709ba2b52d0e7c4a26a9bda280a2c6087a29e0ede787b212ecf8843a5

SHA512
242ef53d719c7dd6fa91b0d219f0cd3600252eea4f8eead8f2e41ceabdcdb2fc7db049a9b93f67bdf37862b69bf58c332c115f4d91a5f3e6c8ac9fff01d80841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_91DF16218BAC821A4575D2F721820BAA

Filesize
402B

MD5
22f2f75fac9b48a7d6ec920e0050455c

SHA1
63d4204a07ac52c7b5e488f0a3e5d2a21300ab6b

SHA256
50a8397a6efb6f908c2148ec2e29350999f4b06e48fb66935cdde3f59e2a0ca4

SHA512
11ea41f3f9c93d5d1d30f3ff3bf4d3f3a0054d73757e9cea12ddf1ee87c7308833520a97a7c739e4637c0e9043889784069d5a000d90b9d8bc9bac54a7062b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8221ade7a9ccc83829358314d499f3

SHA1
434043e7041df4db7ca63d8cf0e72b5967879644

SHA256
5441f40b508ca81950c9902bb8b3474c7438bbb87874e8fdcd0849944fa57b99

SHA512
64c3c31f9f58a96ea4f89695eb9b4ed4f14cd19e665989cdc85b11b4711bfd22b5aacdaa73fd11b35aff0729d6bed9b09bae695b110f2b6b0efd67941c68a339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8221ade7a9ccc83829358314d499f3

SHA1
434043e7041df4db7ca63d8cf0e72b5967879644

SHA256
5441f40b508ca81950c9902bb8b3474c7438bbb87874e8fdcd0849944fa57b99

SHA512
64c3c31f9f58a96ea4f89695eb9b4ed4f14cd19e665989cdc85b11b4711bfd22b5aacdaa73fd11b35aff0729d6bed9b09bae695b110f2b6b0efd67941c68a339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
c36fb070d8908aad711f7cb567a69b28

SHA1
cbda320b7ba67bce28b88de28c1f4415aed775e9

SHA256
b3973ee4d60a57f586574dd1d96b0f7fb5f6cd7456d41bf9315f2669cfc6903d

SHA512
6bff094a635bd73e7dafeac07071abb1954cc852aff4ee02741d8755e19e2e2a469ccad95bbaeede78bda879932f1db87ecd6f83a4c75db0488d6e3fa4d0ab0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BYN4WSI\openhand_8_8[1].bmp

Filesize
326B

MD5
feff9159f56cb2069041d660b484eb07

SHA1
0d0a08cf25a258511957f357b89d3908f3c5e6e3

SHA256
7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7

SHA512
f850277f48ac14fa363265469776e6f7f07f7dd743aa1d1ad7cf2329eee6d323da3422cf6baac066c84ecd24800a02088053ef3fc0488d170e7fc942ac8ffa99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYTOKVEV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E8C.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E9F.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YRAMJN8Y.txt

Filesize
604B

MD5
75ea4c719bc41ca4927871e519a22865

SHA1
5450acbe690c744cb0f8913e5ecd205d2b6f1c8f

SHA256
8cd199d0fe12eae5220fe8ddb9216414653f3e88950f6f6ac5010f9e4da5645b

SHA512
58435da571762072782cfb1d1999b03c424c585d4b0af969992fcbc29f1ee793f41d6b521bd9694af63d665aca02a29d8eb5781364027d62a2b3d45dbcdfbca6

Download Submit